Windows client guidance for IT Pros to protect against speculative

DJG · 14 May 2019

I take it we need new BIOS code from ASUS for the MDS mitigation. Here's what I currently have for my X99 Strix Gaming:

Windows client guidance for IT Pros to protect against speculative-speculative.png

Ground Sloth · 14 May 2019

Why did Microsoft only release new microcode updates from Intel for older versions of WIndows 10?

In any case, it sounds like the mitigations against the Microarchitectural Data Sampling side-channel vulnerabilities basically don't work with Hyper-Threading enabled.

Cliff S · 15 May 2019

See also: Intel Side Channel Vulnerability MDS

On May 14, 2019, Intel and other industry partners shared details and information about a new group of vulnerabilities collectively called Microarchitectural Data Sampling (MDS).

First identified by Intel’s internal researchers and partners, and independently reported to Intel by external researchers, MDS is a sub-class of previously disclosed speculative execution side channel vulnerabilities and is comprised of four related techniques. Under certain conditions, MDS provides a program the potential means to read data that program otherwise would not be able to see. MDS techniques are based on a sampling of data leaked from small structures within the CPU using a locally executed speculative execution side channel. Practical exploitation of MDS is a very complex undertaking. MDS does not, by itself, provide an attacker with a way to choose the data that is leaked.

MDS is addressed in hardware starting with select 8th and 9th Generation Intel® Core™ processors, as well as the 2nd Generation Intel® Xeon® Scalable processor family. More details can be found here. We expect all future Intel® processors include hardware mitigations addressing these vulnerabilities.

Assessing Risk

Exploiting the MDS vulnerabilities outside the controlled conditions of a research environment is a complex undertaking. MDS vulnerabilities have been classified as low to medium severity per the industry standard CVSS, and it’s important to note that there are no reports of any real world exploits of these vulnerabilities.

As technologies become more and more complex, we believe it takes the ecosystem working together to keep products and data more secure. We appreciate the research community and our industry partners for their contributions and coordinated disclosure of these issues.

DJG · 15 May 2019

Good info, Cliff S!

Ground Sloth · 15 May 2019

Contrary to what Intel is saying, the researchers who discovered one of these new vulnerabilities claim that 9th-generation Core processors are actually even more vulnerable.

Fallout exploits a fourth vulnerability in Intel CPUs to leak data from Store Buffers, which is used when a CPU pipeline needs to store any type of data. This attack works against the Kernel Address Space Layout Randomization (KASLR) protection against memory corruption bugs.

The attack was developed by researchers at the University of Michigan, the University of Adelaide, Worcester Polytechnic Institute, Data61, Graz Institute of Applied Information Processing and Communications (IAIK), and the Catholic University in Leuven (KU Leuven).

The researchers say that the threat actor running a Fallout attack can choose the type of data to leak from the CPU's Store buffer.

Fallout also impacts modern Intel processors, including those of the 9th generation, which include in-silicon mitigations for Meltdown.

This protection, however, "makes them more vulnerable to Fallout, compared to older generation hardware," say the developers of the attack.

New RIDL and Fallout Attacks Impact All Modern Intel CPUs

Cliff S · 15 May 2019

@Brink one more to add to the list "Read more": https://portal.msrc.microsoft.com/en...sory/adv190013

MikeMecanic · 15 May 2019

New patch (May 14th) and new cmd line to check MDS vulnerability:

Code:

cat  /sys/devices/system/cpu/vulnerabilities/mds
Not affected

uname -a
Linux kerenl 5.1.2-050102-generic #201905141830 SMP Tue May 14 18:33:14 UTC 2019 x86_64 GNU/Linux

LKML: Greg KH: Linux 5.1.2

<< ...So don't think you are done updating your kernel, you never are done with that>>

Brink · 15 May 2019

Cliff S said:

@Brink one more to add to the list "Read more": https://portal.msrc.microsoft.com/en...sory/adv190013

Brink · 18 May 2019

How to test MDS (Zombieload) patch status on Windows systems | ZDNet

Same from

Verifying that protections are enabled section in first post.

CVE	Requires CPU microcode/firmware?	Mitigation Default status
CVE-2017-5753	No	Enabled by default (no option to disable) Please refer to ADV180002 for additional information.
CVE-2017-5715	Yes	Enabled by default. Users of systems based on AMD processors should see FAQ #15 and users of ARM processors should see FAQ #20 on ADV180002 for additional action and this KB article for applicable registry key settings. Note: “Retpoline” is enabled by default if Spectre Variant 2 (CVE-2017-5715) is enabled. For more information, around “Retpoline”, follow the guidance in the Mitigating Spectre variant 2 with Retpoline on Windows blog post.
CVE-2017-5754	No	Enabled by default Please refer to ADV180002 for additional information.
CVE-2018-3639	Intel: Yes AMD: No ARM: Yes	Intel and AMD: Disabled by default. See ADV180012 for more information and this KB article for applicable registry key settings. ARM: Enabled by default without option to disable.
CVE-2018-11091	Intel: Yes	Enabled by default. See ADV190013 for more information and this KB article for applicable registry key settings.
CVE-2018-12126	Intel: Yes	Enabled by default. See ADV190013 for more information and this KB article for applicable registry key settings.
CVE-2018-12127	Intel: Yes	Enabled by default. See ADV190013 for more information and this KB article for applicable registry key settings.
CVE-2018-12130	Intel: Yes	Enabled by default. See ADV190013 for more information and this KB article for applicable registry key settings.

Windows client guidance for IT Pros to protect against speculative

Windows client guidance for IT Pros to protect against speculative

Busy Day For Intel Processors 20190514